[java-metadata-aggregator] branch main updated: JPAR-205 - Update Bouncy Castle components

[Ian Young]

This is an automated email from the git hooks/post-receive script.

iay pushed a commit to branch main
in repository java-metadata-aggregator.

View the commit online:
http://git.shibboleth.net/view/?p=java-metadata-aggregator.git;a=commit;h=cfbaac6ca687771824991ad89c1539d091d0576b

The following commit(s) were added to refs/heads/main by this push:
     new cfbaac6  JPAR-205 - Update Bouncy Castle components
cfbaac6 is described below

commit cfbaac6ca687771824991ad89c1539d091d0576b
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Thu Jan 5 16:15:52 2023 +0000

    JPAR-205 - Update Bouncy Castle components
    
    https://shibboleth.atlassian.net/browse/JPAR-205
---
 mda-framework/pom.xml | 12 +++++++++++-
 pom.xml               | 19 +++++++++++++------
 2 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/mda-framework/pom.xml b/mda-framework/pom.xml
index 32b245f..256515c 100644
--- a/mda-framework/pom.xml
+++ b/mda-framework/pom.xml
@@ -32,7 +32,7 @@
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bcprov-jdk15on</artifactId>
+            <artifactId>bcprov-jdk18on</artifactId>
         </dependency>
         <dependency>
             <groupId>org.cryptacular</groupId>
@@ -93,6 +93,16 @@
             <artifactId>jython-slim</artifactId>
             <version>2.7.2</version>
             <scope>test</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcpkix-jdk15on</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcprov-jdk15on</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>${spring.groupId}</groupId>
diff --git a/pom.xml b/pom.xml
index 3ffcd50..275c0e1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -215,13 +215,8 @@
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-enforcer-plugin</artifactId>
                 <executions>
-                    <!--
-                        Ensure that we're not either directly or indirectly making use of the
-                        joda-time package. Our time handling should be exclusive based on the
-                        java.time package introduced in Java 8.
-                    -->
                     <execution>
-                        <id>no-joda-time</id>
+                        <id>banned-dependencies</id>
                         <goals>
                             <goal>enforce</goal>
                         </goals>
@@ -229,9 +224,21 @@
                             <rules>
                                 <bannedDependencies>
                                     <excludes>
+                                        <!--
+                                            Ensure that we're not either directly or indirectly making use of the
+                                            joda-time package. Our time handling should be exclusively based on the
+                                            java.time package introduced in Java 8.
+                                        -->
                                         <exclude>joda-time:joda-time</exclude>
+                                        <!--
+                                            Ban use of older coordinates for Bouncy Castle components.
+                                        -->
+                                        <exclude>org.bouncycastle:*-jdk15on</exclude>
                                     </excludes>
                                     <includes>
+                                        <!--
+                                            joda-time may still be used in tests.
+                                        -->
                                         <exclude>joda-time:joda-time:*:jar:test</exclude>
                                     </includes>
                                 </bannedDependencies>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.